CVE-2026-47691

Medium

Elevated severity or exploit probability.

CVSS base

8.7 HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

EPSS — probability of exploitation (30 days)

0.3%

24.9th percentile

CISA KEV

Not listed

Weakness / dates

CWE-346

Published 2026-06-12 · modified 2026-09-18

CVSS breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Attack Vector	N	Network
Attack Complexity	H	High
Privileges Required	N	None
User Interaction	N	None
Scope	C	Changed
Confidentiality	H	High
Integrity	H	High
Availability	N	None

Timeline

2026-06-12 — Published (NVD)
2026-09-18 — Last modified (NVD)

Description

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Affected

netty

References

Official: NVD · CVE.org